# CVE-2026-7380: Armiya Information Technologies GKS XSS in HTML attributes

Source: https://junglewise.ai/threats/cve-2026-7380-armiya-information-technologies-gks-xss-in-html-attributes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-7380 · Severity: medium · CVSS 6.1 · Published 2026-07-07

Armiya Information Technologies' Access Control System (GKS), which manages physical security and entry permissions, is vulnerable to a web-based security flaw. An attacker could trick a user into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the user's browser. This could lead to the theft of login sessions or the performance of unauthorized actions within the security management interface.

Technologies: [Armiya Information Technologies Ltd. Co. Access Control System (GKS)](https://junglewise.ai/threats/technologies/access-control-system-gks). Vendors: [Armiya Information Technologies Ltd. Co.](https://junglewise.ai/threats/vendors/armiya-information-technologies-ltd-co).

## Quick answers

**Is CVE-2026-7380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7380 being exploited in the wild.

**How severe is CVE-2026-7380?** Medium severity, with a CVSS score of 6.1, published 7 July 2026.

**Which products and versions are affected?** Armiya Information Technologies Ltd. Co. Access Control System (GKS) before Version 2.

**Is there a fix for CVE-2026-7380?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7380 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7380?** Check whether you run Armiya Information Technologies Ltd. Co. Access Control System (GKS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A basic Cross-Site Scripting (XSS) vulnerability exists in the Armiya Information Technologies Access Control System (GKS) due to improper neutralization of script-related HTML tags. The flaw specifically allows for XSS targeting HTML attributes. This is a network-reachable vulnerability that requires no prior authentication but does require user interaction (UI:R), such as a victim clicking a crafted link. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized configuration changes. The issue is addressed in Version 2 and later.

## Affected products

- Armiya Information Technologies Ltd. Co. Access Control System (GKS) before Version 2

## Timeline

- 2026-07-07: disclosed
- 2026-07-07: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0502)

## Related threats

- [Armiya Information Technologies Access Control System missing authorization](https://junglewise.ai/threats/cve-2026-8377-armiya-information-technologies-access-control-system-missing)
- [Armiya Access Control System (GKS) Reflected XSS](https://junglewise.ai/threats/cve-2026-8309-armiya-access-control-system-gks-reflected-xss)
- [Armiya Information Technologies GKS stored XSS](https://junglewise.ai/threats/cve-2026-8306-armiya-information-technologies-gks-stored-xss)